2 Threats, Risk, and Security Governance Free Online FlashCards

What is an asset in information security?

An asset is something valuable to an organization, such as customer records, employee devices, or the ability to deliver a critical service.

What does the CIA triad protect?

Confidentiality prevents unauthorized disclosure, integrity protects against improper alteration, and availability prevents disruption or loss of access.

How does a threat differ from a threat event?

A threat is a potential cause of harm. A threat event is something a threat source might do or cause, such as attempting to steal credentials.

What is a security vulnerability?

A vulnerability is a weakness that could be exploited or otherwise contribute to harm, such as unpatched software or excessive account privileges.

What is the purpose of a security control?

A security control is a safeguard that reduces the likelihood or impact of harm, such as multifactor authentication, tested backups, or encryption.

What two factors commonly guide risk assessment?

Risk is commonly assessed as a function of likelihood and impact: how plausible harmful events are and how serious their consequences would be.

What should a risk assessment consider when estimating likelihood?

Likelihood considers how plausible it is that a threat event will occur and cause harm, taking relevant vulnerabilities and existing safeguards into account.

What kinds of consequences can determine risk impact?

Impact includes consequences for operations, people, information, finances, legal obligations, or reputation.

What should accompany qualitative risk ratings?

Likelihood and impact ratings are estimates, not precise measurements. Document assumptions, evidence, uncertainty, and the reasons for each rating.

What are four common responses to risk?

Common responses are to mitigate, avoid, transfer or share, or accept the risk.

Does transferring risk necessarily eliminate responsibility?

Transfer or sharing arrangements, such as insurance or contracts, allocate some consequences but may not eliminate responsibility.

What is residual risk?

Residual risk is the exposure that remains after controls are applied. It should be reassessed and compared with the organization’s risk tolerance.